Generate an RSA key pair for DKIM email signing. The public key goes into your DNS as a TXT record. Keep the private key on your mail server.
Configure options above to generate a DKIM key pair
DKIM (DomainKeys Identified Mail) uses asymmetric cryptography to sign outgoing emails. Your mail server signs each message with the private key. Receiving servers verify the signature using the public key published in your DNS as a TXT record at selector._domainkey.yourdomain.com.
Choose 2048-bit keys as the minimum. 1024-bit is considered weak and is rejected by some receiving mail servers. 4096-bit provides maximum security at the cost of slightly larger DNS records and more CPU use per message. The selector can be any alphanumeric string - it lets you rotate keys by using a new selector while keeping the old one active during the transition.
After generating: (1) add the TXT record to your DNS, (2) install the private key PEM on your mail server, (3) configure your MTA (Postfix, Exim, or your ESP) to sign with the private key using the selector you chose. Verify the setup with the DKIM Checker.
Sent to our server: Selector and Domain. Everything else in this tool runs in your browser. We look it up in DNS. Part of this work runs on our own server. To answer a repeated check fast, we have to keep answers for 5 minutes; then they are deleted. Also added to the page link, so you can share the result: Selector and Domain.